579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
Size 6.5MB
Sample261003-prw8psydnc
SHA256 579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d
MD5 bf3affc7fc8bf7db0f56f0371afef180
SHA1 da933df72ce39d9b5610425062d850b98dbe2942
SHA512 b0f18bf76e14cfc0b98645f214c821a4e7b9e7b4bb78237dcc0863d3906498b5a9fd72521355572b115133d36579247d5d406e800a9e7b0dfe7db89e22c8ef87
SSDEEP 49152:S28aYVjCt4d3d8iKnwMlCaDsLuYwZp3L13x2RKY6/QxWRmLnibA4dJFMo54aWXOU:gPItBnqeJC6owb3+U4BGmuTpTrha+k
TLSH
T190666A03F19910D8D059D178CB5A9232EB72BC494BB172EF2A5077D22E76AE0BB3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2680	alg.exe
3024	DiagnosticsHub.StandardCollector.Service.exe
4604	fxssvc.exe
4752	elevation_service.exe
3832	elevation_service.exe
3392	maintenanceservice.exe
4736	msdtc.exe
564	OSE.EXE
408	PerceptionSimulationService.exe
2492	perfhost.exe
5040	locator.exe
2772	SensorDataService.exe
360	snmptrap.exe
3884	spectrum.exe
2340	ssh-agent.exe
3520	TieringEngineService.exe
2640	AgentService.exe
2828	vds.exe
2396	vssvc.exe
380	wbengine.exe
2316	WmiApSrv.exe
1964	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
\??\F:\	alg.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\system32\dllhost.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\system32\vssvc.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\system32\wbengine.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\System32\vds.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\system32\AgentService.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3279e5fa862f6ed0.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\GroupFormat.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d42f2973353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e56e6973353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000684a57973353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008f986973353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075250a983353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001080af973353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003881f8903353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000956475983353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4224	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
Token: SeTakeOwnershipPrivilege	1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
Token: SeAuditPrivilege	4604	fxssvc.exe
Token: SeRestorePrivilege	3520	TieringEngineService.exe
Token: SeManageVolumePrivilege	3520	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2640	AgentService.exe
Token: SeBackupPrivilege	2396	vssvc.exe
Token: SeRestorePrivilege	2396	vssvc.exe
Token: SeAuditPrivilege	2396	vssvc.exe
Token: SeBackupPrivilege	380	wbengine.exe
Token: SeRestorePrivilege	380	wbengine.exe
Token: SeSecurityPrivilege	380	wbengine.exe
Token: 33	1964	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeDebugPrivilege	1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
Token: SeDebugPrivilege	1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
Token: SeDebugPrivilege	1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
Token: SeDebugPrivilege	1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
Token: SeDebugPrivilege	1604	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
Token: SeDebugPrivilege	2680	alg.exe
Token: SeDebugPrivilege	2680	alg.exe
Token: SeDebugPrivilege	2680	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 1604	4224	579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe	86
PID 1964 wrote to memory of 3688	1964	SearchIndexer.exe	113
PID 1964 wrote to memory of 2572	1964	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
"C:\Users\Admin\AppData\Local\Temp\579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe"
1⤵
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Users\Admin\AppData\Local\Temp\579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe
  C:\Users\Admin\AppData\Local\Temp\579057c3f1f8e9bbe21a72e0f80a15fc1298ce59ab849f6be5a1d803d3b1035d.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=125.0.5729.58 --initial-client-data=0x268,0x26c,0x270,0x23c,0x274,0x1405b9b78,0x1405b9b84,0x1405b9b90
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1604

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3024

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1672

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3832

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3392

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4736

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:564

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:408

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2492

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5040

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2772

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:360

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3884

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:816

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2828

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:380

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2316

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3688
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 310c87e52cd6745392f9a2368eadfe595c38799302d275919e1efae47fcdfc3c
MD5 62ff78b64343928f26146ab983c45781
SHA1 49412a61e182e2b60c4e91dc0945c083da25a020
SHA512 3f7b9bfb7bcaef04035355de0e1a82c5af2927c818546b02bf9d9bb62dad36ed3e571bfe63fab5bac749748bdc973674ee01b5476b0fe79ac36436d74cd06fe8
SSDEEP 49152:kb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnIB+kn3Hnx:e3q6sjB7+k
TLSH
T156D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 b11346a821292fab0f7fffe84819d6385e342593f186732d54c3068e6395a789
MD5 f676adc5857dec4d01e5ac831a49656b
SHA1 5b822d724561e49137013d411c090768e992a9a6
SHA512 ec14ffa5bf11a1d96b47d6a40d2709a0f0de4e3b5c08c6a0f71b2f8fb3fcad74ee785aa4a50196fb7fb0bfc8ca724d60f30fc9f9ce9c40638e5f5a97de9fb520
SSDEEP 12288:Y1XLsswWkxy2lRq2czAlLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:eXYfDtczA6NyBo4kx929bL3Hnx
TLSH
T17A65012967D409F9ED6B927CC8A28511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 197ef816228a6ad76702c61ef674e8e8a9d609e27d208fb0e7dfdb9550bdebb2
MD5 0e204599c4f2a6fd3888e6c8dbbdcf6d
SHA1 ad5bb36b0c583295c4d0eac526af7b4b6d002b34
SHA512 80274c8f0b3c1d90a224de0bb112c123e1f624fbc1b04a582dc29306051541f118d2de8d2a72646c6ade61bde5e8ca0ed70ba572a14db689df39d1315d7317fe
SSDEEP 12288:DXZNYVLeyUji0h90ZD0wxpGZIVuArHswLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:10Le5ji0hmxfrMPNyBo4kx929bL3Hnx
TLSH
T11E859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5c1e5d833e6e11af631a1e2bab42e265bc1061f8d5a2019fac51a872d40a42ff
MD5 1705ad46f848563b187e97ac3be104d1
SHA1 974a499efd5dbc638bc2d5018600796ccddae99f
SHA512 b1fa0716354072d415d3bc80a0e27dba68aac5269701c382f5ece6049403f8e6f7dcf8247d61ad5bdb5d238710ed6a81a879208b6c7277e8f0497a8f6c506909
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWn6q8wyuVNyBo4kx929bL3Hnx:w/ezSC6vUzPveHjyTB+kn3Hnx
TLSH
T161755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 aa0e82f320c72adb944f9ce92b55a76ae211e83caa3d5553b5f0486cc5fad967
MD5 fd379fbf0ac6f661430651988aba91ed
SHA1 581329f1cb96e15a49ff3a51058365fe41e03d9b
SHA512 162430fb28d12d71bcf8b7974944c0a35cddfe2a7013da5c6384437ef3f23a40dd21f0466a730efd6a828c093d523c301d9ebfd21af1e18b32f1559449ba8669
SSDEEP 12288:/VJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98ZLDAptNyvUgXZ32dT4ePc7N29CD:/VbqPb88hv/l+YGNyBo4kx929bL3Hnx
TLSH
T17C559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ca4f2a58c7cd10c9aac902f684e015c432b75c9ec4c1034c53eeac368529116c
MD5 518d072ed2a33a5cfa5bac275f6aaec5
SHA1 418624a2d1d7b7971cc7227f7b455abfab6a9417
SHA512 3d9266ad2dc211ce70f1184f907df9eae3ad436ba1e59eda69e2af39c087de46a065c837a7c223e9c7b35c78a4eabb4cb414fe68e8c31a85a4772fd808e72e55
SSDEEP 12288:AmkLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:Am7NyBo4kx929bL3Hnx
TLSH
T13B4523124B0C627AFBBD3F70749E8454CC35BC890D95DB94DE62ACBB58BCDA2DA21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 c93024b9bcec86c9e56de301b025718d1bc70c4c2cb4f218e6d17fae0377cb19
MD5 59d8b06f70103c87b06f3373f95a15bd
SHA1 f3d1c36de555be94738e4170ca7c46735bd390af
SHA512 5428132eefe3659ac93ef92b39d00d67704dc4acd791ef46babe6a50d7725a1ae455d28546383680bea45f39bb38450f3d243a2d733e2311df91bae9f1679690
SSDEEP 12288:TeBNUbTVO86UxLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:TJIUONyBo4kx929bL3Hnx
TLSH
T1B465CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dba90c3df224e2f4eeba56eef7f4ab3a03670c9efcc4ad10c978b4466f8d0dab
MD5 d39c555c3cd4c1a3b6161e33c0dd16de
SHA1 9db4adc0d3187a425fa4f6986027882e7b261705
SHA512 043bfda9fc2962f666a58d06c6d76ea8a100c09a200483f04703a80837e9f46cefbfbf65373aaaae3bf03a7774aba5348e51208fca1766c6b2251f90670f5361
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THz:KQvGAdlCEL8c/DRNw5Ca+k
TLSH
T103266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 512acfe4f3101d8109b4a07adcf0e60ea7629b8c491577b1624c76cd8840308c
MD5 6984cf5f50e70ff7bbf9340a30902156
SHA1 85746cd2766fa9e1a17d93aa838686789fb001a1
SHA512 91c632ca031729278174c4716233db3bf1f2c920688b7ef1277c5337294dfa5c210beb9b64c8761a9acf262a095f8ee220a81b0ae6c0714479ed240782cce997
SSDEEP 12288:2AwSfxL/2Dc3XDLLmt0LDQewsAj3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:LOewsAjMNyBo4kx929bL3Hnx
TLSH
T19F75E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c4fe3136fa123c396362f8e0b59af3298245931174dd287dc7217098a556f4a8
MD5 a758dc901565b15b259804f4de57a882
SHA1 2ec3cb43d10b71e68c18c8ffed0308bcde6364ef
SHA512 374d56c52f794a287db6fe1f46ad95cba0290ffd87242c4e3b9df2dc14ec5640bf77fc5462e4038293e329cc80ed317556ab8688700be44e99a6f06444d9d0cf
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHp+k:7UEtQevvqc2W1cpV2tI32p
TLSH
T184474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9260269fae78dc2102fd3dda783781bcbbba4242386ef67f008c67ca758f4879
MD5 74ca91b034f69f9fa49a71c9e3bc6c44
SHA1 65a8a6f3a5157c794ce230fb102bf35dbee206f4
SHA512 78ace1e7506f3e8a0d46abbd0b665bc652885cb1088e44b21a0a6bf36373d1e2f64a2809f4a4fdf8bc2e1d3561ca7afaea764e916e0dc0fde83ab73a1f58e3e9
SSDEEP 49152:RCbRquA/m2yL5zTfFiV+XenmE3/z3B+kn3Hnx:eoquVjnmO+k
TLSH
T117D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0b756e54ad1f7ba3fd6e956f9090f8c2bcecb26c61fdf783f31d5f42f83315e2
MD5 38c3f63ce29d178d85589a36ad1d2ba4
SHA1 d4e8049e411b0346bd739d03c6c8f93b28acdfe2
SHA512 97078bc206923747668578dd2789a76a2c985f75f4e4eb0a4aa151e85a7b87c58f99dc4750b89470fb412dc2bc6ff994f2ee980eb9ed7993e344108265129ed2
SSDEEP 24576:1AhGL3IFoiwtA5l7S53JNyBo4kx929bL3Hnx:1AMUFoiq5+B+kn3Hnx
TLSH
T193359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 3d73784e8592e64fb127e5e698f0e426a0870888676d5ce1ad5516ed0bea6d98
MD5 40b674e165c0d2e9e4b55f4dc3baac79
SHA1 f2ab662a63f9142ed72bbbf53395cbb03de8037e
SHA512 c0f13cb8c2a15c7ef4791f813e31a75b2d774b1877ae1338d2e7bc106ac060ad39e052bdd5b53348a326726c890846377081cc0446e7a30db99e9eec2c6c53fe
SSDEEP 12288:7mw5HEjsChNzBFgl0WDm+CWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:awu6OWANyBo4kx929bL3Hnx
TLSH
T19B65F10677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3337a107056ee5e5a88b27b7068e9db404f95c5064298ccd7388ec7cc4461da7
MD5 ca7a39e7a58ada260c0285d8e7e63c8f
SHA1 9e24abdd208d4018abdeea2b614af0db6f19e389
SHA512 2cea98f0571e2db8497a8c1ad7097931138dc8929721c5b71ba2b9bf161ac54a28ac48b3d94e62a7e9e98dbc2133e29def15e983ae446c37a17a1597752d6579
SSDEEP 12288:bgZ1IynLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0Zu3NyBo4kx929bL3Hnx
TLSH
T1BD551216239831FAF2AB2678D8E58544CB32BC461B7283CF5A2145BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2d1181b93c36f19f55aee7a7069b5010aa707778a50c7d3aac10eb44e4961e22
MD5 ea99b53ca9191410146b9dfd649a6dcf
SHA1 c4de7ba972111573e82a5799287aaa49a5ce2214
SHA512 6008aa2dc3f9b72bc6eba68a2deb2b0b1e6b8c5a486a6c1d1a772b76aa47d80a8f0905675b188d5d4817879bf9dace297abf45e72fb43a244f2564d34db7f7c4
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UH:yQRQyi36YOcPbLvw2gAf+PN3n+k
TLSH
T1E5666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4727f36197f0a78c598e88040f258dad59010530121cce0b3a4c545c6a024256
MD5 29d20e6dbb1d6a2ca6e08730734d701b
SHA1 ffd38a066c9e058e264ff6b7c132ea07117494e5
SHA512 2f7020061695eadee5e316e28114c2d5510af7cdb5ec7fa7ac6381901629ba466584b828d4aa2a2306be314919659cb03419cfe28c614a83095ed96aec4efe37
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UH:JQRQyi36YOcPbLvw2gAf+PN3n+k
TLSH
T119666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 92a747581515b1140f7728cdb42008ab2d8e9dd9b3d48976c72af3fe613264a6
MD5 8910fbfc266da817988382fa30191f57
SHA1 159186bffaa25cd6e257a26d94a1c3565834779a
SHA512 cfd0f0ff5b77dbfddba971ec97a847ae834093d6c9e642dcdd2629adac7517df43f76a1e78b54303af3d1b13c894a197299ff9353572867803903a8e25ad5fde
SSDEEP 24576:dwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0nNyBo4kx929bL3R:Z68Qg55nhceWu7PNU3/nB+kn3Hnx
TLSH
T1CBB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 35f4270f4b0e68b70af01ce0ef1ae539b5576e65824e21702bec71a71c35b353
MD5 b49da1784b04e3a0d9d3970df09544db
SHA1 b431446077b1b3bad7059302bbc24fcaa7175faa
SHA512 348c4544e49de7cebf35505e05bb3f3e564542cc3937f8506af7ec80bf5c98e70c49156e44781d546283ad3d8bdf7ff85b336fdbe1e2de0f13f6597ce03a7f31
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99F:jy5112gYy5azzVvt69nLKnhZo+k
TLSH
T159167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dd3719471b4ae31ae395020dea57919b91086eee3701d710cb0d3ccd96c48496
MD5 b72ab1619203042eda58d34517a1f6df
SHA1 1386ac39fc9902b469435597db460140c4ebe809
SHA512 776046a59347792103b40bce3eba53e11f1299c8b0fdcab9d502c9a45d17c238ec73e561c8fc848ccbdb01d1f154bd54176e1598467cd3c5c0efa715de4443a8
SSDEEP 49152:jB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl5B+kn3Hnx:Vu6Jmdxd2dv+k
TLSH
T1A1D5AD13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ba2d31a6a1f7bbe70d0b417de0f554c591376ff9af556a2e9932f7e2dce20c87
MD5 c254502cb15c70bd55ca17da9122171d
SHA1 d3e750a3e82140a324f53ceb2aacb88b11970ec3
SHA512 2b72834f856516b04c79e995643ded70ffc757e1f77473e82d2f6c373c042e6f4a66a3250adef045d98c1b9ac9ddf09f41ba8d11079e3e1c9de7651d27287bfb
SSDEEP 49152:z1hpsNoJpF1A63U44CwH7R4xFB+kn3Hnx:zmifPWRO+k
TLSH
T10DB5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 70d44f542d46e7dfca477e16ac9f091688fa2bdb4af27c0ddf730e561f7cd20f
MD5 55556c1a26a8236b68a8527fc155e6f6
SHA1 6fb5e7d8c0f1a7759cb04353f48c6354ce5b9b8a
SHA512 31ef7a41e1203d57506cf65d26e68eb3ed47002f2001296cbda8700fd0346b92364ecc72407ba7dfcf1061700fce2b2d66bb13d9be2557ba1ddfea201703c633
SSDEEP 49152:VSuZQIY0Be2KcRVtOnks6NMHq4B+kn3Hnx:75dKii61k+k
TLSH
T19BC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cf9764b9961c8774a022b41d7276be255c2add8114c987706d4a46ea04dc0917
MD5 41a74f14cc27a86eec4783ab2115a4fa
SHA1 37b7b20eacfbe6d60787dc3ebc4379c7a5de2558
SHA512 1984b0371cd4db0725359ac76a663122e8fe472d80a981fa8c239bf69eef961f6297f3eff2b1ac9f4520606da2a563be3e3c3a9592a084310eca1a5bc627f3ed
SSDEEP 49152:6htSn8EApI0fig3giDn0AP5wpB+kn3Hnx:7X2imphy+k
TLSH
T1C195BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e511ecc51db5876d5647df7aff28bcfbfebb5fb4ca7b1f977e6ef7e201948f60
MD5 153f6e7735e6c24463fff6ea97aa6fbf
SHA1 5c2c1bb3dad712d364fd4f6b469130006b3861a6
SHA512 47fd660985d872f6b6bc2a386f697f6e85e2d095dcf822c0972077e6ea876f55692941e30d68bf2dc14efdf63d6dc36a7f62b944d8a706c2c332b0411d232e17
SSDEEP 12288:g8LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gjNyBo4kx929bL3Hnx
TLSH
T14E4523025A0C637AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c15cb0ddd971b599d5c34b5f7fa2bfc36eb29545b36abebe845c36cf4295fadf
MD5 a8b37658540285ef34b4e0147c66346e
SHA1 cca773562153c19b7479cf5aa0f4adbd88793940
SHA512 6bb4f3aff513da30fa54bf67370bfa331b1e35e4a05e70699bc07124d53659c474d62b261bfc3f87d9dc34c3b20c251870308368e782c5f56ff9ca6907eb290f
SSDEEP 12288:H7LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:HYNyBo4kx929bL3Hnx
TLSH
T1AD4523125A0C227AF76D3FB0644A8098CC34BC8F1E9597D8EF67987759FCEA25B21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 680de983579b815a3bf926d0e5fd6d6749d39b5e05483b260cc0b4f3bf04c62f
MD5 3afa32633e5a0e9bc3fda4b3ffbe2509
SHA1 22ab35edf0804f3eb275e1b88c7391b74141fba8
SHA512 6d9c906ca7a518bf7c6545da0d48308bbe1917e07752e41f8b306332cc1dcc8c10f704cf66a1e269414957808700274604043df399de03ee6d3845a642c65e26
SSDEEP 12288:JpLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:J2NyBo4kx929bL3Hnx
TLSH
T1144523125A0C627AF76D3FB0644A8098CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 968193f678fed6c26947ab9f0068388c454e8c786c94a5e9c3623f8e63cb92d5
MD5 efa9a9ecde507e150ed211b865a45cc9
SHA1 749a48f6a82521126abb1808810e0cc8b1cadb32
SHA512 bac92b5896510ba6387a0e057cf535e211f22b5cfa2b523b592b6dd0c137bd2de367317619fbe409e4076918ca3e77350d3242c208988adbfb9a8ed973bcd193
SSDEEP 12288:SViLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gNyBo4kx929bL3Hnx
TLSH
T1E34523025B5C12BAF9797BB098568054C835BC8A5B7197DFDF124C7B0DB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 64fb3542e585bd3ecb3ef6e19eb75be314de9c7510366f96f47c14385e0d75d9
MD5 7af4edd04ea66f914a5b3184bebb8c48
SHA1 c209b357014636dc1e1301a1d5a1539eb4a5c055
SHA512 8ea30e8eed3ae3e570ec0b68989fa5fb752efd4c1685b79432ae69177af90499b3fef50db1a9c655031f7c203d1f0134cc677a4547f6c82818ba101aae4fa782
SSDEEP 12288:oqLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ohNyBo4kx929bL3Hnx
TLSH
T1D64523025A0C627AF76D3FB0644A8098CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0475ccb737d6d42d8ec411e6c1fff35fae3c7143252ab90dd65c295112af7b0b
MD5 d4dd7a41f2002c24d61016f1d4bf2978
SHA1 20683dbc38dff5e8e8648a8fa7414ae8955329c3
SHA512 cb94c94324cd8f2d7635548411f978ae82630f05ffda51f518f2411346489665db6fd5560a30d2b9d7251a7a792c68f80b281dfbe90733c1e0060159828ff362
SSDEEP 12288:1vLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:1UNyBo4kx929bL3Hnx
TLSH
T11F4523125A0C627AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ecbe59c3fcb3389a3bc62694b63670790030ae863516178fe29098603b896b41
MD5 883903e3f369645df42feca767275020
SHA1 f6d5da5dc2fdadc88cef11bd45ec5b357fff4cdc
SHA512 1289336a0d7ea3cce4ad0dc2b9e60ba66e1e905a433ff249585265cb3fbae5546939ac1b4e4ae0ec62b7b6cd481645fd995521f0d1312c03cdc39e575fd382ef
SSDEEP 12288:bjLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:bwNyBo4kx929bL3Hnx
TLSH
T1164523129A0C237AF76D3FB064498498CC34BC8F1E9597D8EF27987759FCEA25A20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 4e1e275c5bf8189643acc8088d039297857cc9bda46bbc2d6202cee428e9f20d
MD5 e0e39e5a1bc2e920473c5c0cab74d910
SHA1 634ac48e33c6ee0df460aa1d0f7ada874e33ce5c
SHA512 8225ff43559b2930498b65e2ef2e2a4f036224b9aa436e698b02c7b72c9e82b11ff046a6ed23d3e0a7db4089be0a8f44f78a9d7337e67c302b4af6c59b420b82
SSDEEP 12288:KiZwbjzzFEoS2cPvybLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:tZMXzFVSO4NyBo4kx929bL3Hnx
TLSH
T1CA650195B39418F8EC67823DC8158906C6B2BC4A0BA0C65F07B4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8f4d99c0099278255f9c8dc46b8ac36d325075f3fb96699d24591047e0b6f81f
MD5 ae515896192c4e83dcd76c806ec7d155
SHA1 72925e9d751662f36b911377ff18e27b97efac33
SHA512 0b0542827b9bcf030cc336f9a96a6f19551eb536f24ef8fafa7dcf87b22ab578687157389018006a436bf8b418c8009cf764cd3c44d727e4ce8e447aa4bae9f2
SSDEEP 12288:FYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:FHNyBo4kx929bL3Hnx
TLSH
T1DE4523025A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8334f1a2c5a00faa91824d70dc7a44513136a42bc1c656fce34d1b8206d87742
MD5 aef14a8552485146a5c15c70f2b4b249
SHA1 6eacf0385bec6bef0ea18559a0858efa0b36f9ba
SHA512 0c83d463b52e3309426d07f5991a878d90bef8c7d58b58d8b180f52a6fb3a986d7e20f1ebc7f4630fcb70ed9729385f278f8323636528411c8b4c44079ac08e9
SSDEEP 12288:QULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QLNyBo4kx929bL3Hnx
TLSH
T1374523125A0C227AF76D3FB0654A8498CC34BC8F1E9693D8EF27987759FCEA25B10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a024906786e4b1cbb8e1aa11f943eb41511d2d12dfebbcdae750573d6581840c
MD5 9aaabf520072409358b95cd895929e46
SHA1 b7a789b54e2fcaf207c814d40e60f8db7023260c
SHA512 346d7dabeda57552e431078d109bbacff34e19ec3d495124c760492ea2d3f8fa9de69f8dafcfdf657556a27ca06737e9a518fe7bf03c093f551013e61662060d
SSDEEP 12288:nyPz5L8nLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:KzycNyBo4kx929bL3Hnx
TLSH
T1D355120777A831F9E17A6234C8960A01E731BC760B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 66e298c1e0e407ce321941f433b8110734eaea3335b5892375a53b123df99563
MD5 b2d695271e7f43519e576ff42afb0380
SHA1 d5ab19e7664be2777d1a94d9457394c056810d28
SHA512 fba24c5bf08a77e366e3e86b1cf63736942d146bd4e102f7860df25b962b9cedb52c510e2a4aefa0005dc29c035be28d9405824de938b607678f97074f4ad156
SSDEEP 12288:RYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:RHNyBo4kx929bL3Hnx
TLSH
T1A64523125A0C627AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f9e9d2fdc5b2ef3b57f801bc44fde55c9c315408bf29f3030cb0e7c8478f1764
MD5 c4c1ca5ddf6dac697ce0e90201686ef0
SHA1 2baacc807b6f74032d55dd100315b73ab22bdbd1
SHA512 e4a36d7fe99420e31fd3d7bdb96e2527ef53ea3bf5fba01a744819683ace3337df9e719718f8a30d92a689b7c6a72742e0a1948ca0b6d5480d04223b32bcbcbf
SSDEEP 12288:tYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:tHNyBo4kx929bL3Hnx
TLSH
T15F4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 b2062eb0a39b7c169caf0cddcf30ba599e58a98a9127a14d916fed7c4907a09d
MD5 0083222203f5101dd519e56aad990678
SHA1 2b23d25488da061ae35a9d1bdd53173649bca39b
SHA512 ee0edc0088f364db80c6e79d390409706c100de3f070049291e1b35d56596660ff476dbca835a7870cb482a26d36afcc38b9cd64031fd76df822f600e8e05777
SSDEEP 24576:ZcP4mcvIjkGOxhKP2l71SNKbrh/8KB/NyBo4kx929bL3Hnx:uP4m4IpOO67N8KyB+kn3Hnx
TLSH
T14D65AE2DABDC0096D0BA917885658A4AFAB1742E1F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 9506f62759fdc190bbcdc171def623a0941fdddad9e5015d1519fb4c0e28d7dc
MD5 684bdc321d34f649610d77e09533d1d8
SHA1 99df55d8e70a865551631d67ac6bbdcbe2387ca4
SHA512 728540c7c1c5a96cc743707d6f6b63b6caeaad8ff8a067c47b6a8c8f79f55971875b23cbf0de7baac3e376c9a0385718795d8eb03bbefc8efeaa28ad655b7458
SSDEEP 12288:6psfoLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:D3NyBo4kx929bL3Hnx
TLSH
T16955F00AD25812E8D16E6274CB468A40F7337C5947E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3279e5fa862f6ed0.bin

Path C:\Users\Admin\AppData\Roaming\3279e5fa862f6ed0.bin
Size 12KB
SHA256 b5cdbb20274412dc4ca3ecc394210cd67b4fef9124834fb6c089ffe92c3c098e
MD5 ae803ee7819fae104709add7f27133e1
SHA1 c7556a3e5bf4fabcf32b32b6235ad62e032d1c79
SHA512 1b040d000f07634951b5e3e398f41c4b1c7d2c28e7f3e4ab163c72fb46b0523bb7a5e119a285dd767a1daf7411e6224c02526d588f6c8d21fbb920ff93d07a99
SSDEEP 192:dOImav593l/JDCmNvOt7iHe/6FcD0ouTMXK0fqkrVFeGsBUA7NDWxL:/vf/2e2Ae/scDiTVYVF+BL7NDWF
TLSH
T11642CF20EC9F008B495BB8AC818447C1C9398489077A174E94DD2C929693F6EE7B2B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b4b8848ad52fa133ab9fef2fe762e8199aee5466ba504baddcc5f5f8bd89638e
MD5 3cf5bf619d221dd13967a5ce75f41318
SHA1 17c33444cb3411bc7fa7211d6c7c4d803baa48c3
SHA512 970d47d4d634925eeb6a88abb826cb4a5c8e21d9d17dd6f0ab2099ab961dd5741e72df85905dd34d110120cf5951c0718e62448607e184a5d070702cb7d0a5e6
SSDEEP 12288:qILDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:qXNyBo4kx929bL3Hnx
TLSH
T12D452312975C623AF6BD3F70645AC024CC39BC4D0F55D6DAEE1258BB59BCDA29E30207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 edb077bddf4d18002f66209f3a182e873a1a9fbd9f8dddf4779e6734472abaac
MD5 7152f45f984ca8430f2a22d4832fbc31
SHA1 524b8a077beacea922e713ae0f6165916f2d3084
SHA512 d58bea9d5bc6b28499eaef044fb041a083e1b89cc375283aed9d33667f24034a1fa7dbec986a5a05f61803c9917d415961c1e45b5544b6c713633585811e138c
SSDEEP 49152:Ra0h2GEkuAe73q3pp46zwwQ2B+kn3Hnx:Ra0hNYG4Jwp+k
TLSH
T1D785AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 d3b8c7968a004b948500bdb45097e1582faae41f4b1f541d23ec3d76bde1fb77
MD5 3c3e068465fe912c2fb501069383ca48
SHA1 34a143b17e8254c36d38f18ce9b1ac9d68c41002
SHA512 b96b0bb0d8f34ffd13b3c08a01edfff07c45cd7d11371688a10d8e0770c1d016e39a0e35fd14b590a737b5f29474e393de2fb3bc1338f28ac7e48f9a5aa32149
SSDEEP 12288:9hbHjfXLLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:9hbHjPINyBo4kx929bL3Hnx
TLSH
T10855123E16AC21E9F275B67C9546850AC731BC1A0B2193EF6792817E0F3BEE50D35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d0758229cd55fda4d4f63d8fb1914c56477855e795bba8030da3a44f86941152
MD5 49e596643c78eeb68eef7dc72992c061
SHA1 a24be006346272bb61982b31a18c7716247588c7
SHA512 39f4d44b8cb253d294adbc4bebc494e02faa26c3bdd0f04e1b15b61b04e563f06e954477dc31157453f5959f3e1f1a7c7dd77be804ca876a39e2f6d7f2a390b9
SSDEEP 24576:13YgnJcRTk4yti+R5dpR/ANyBo4kx929bL3Hnx:1IgnaTk46ppR/zB+kn3Hnx
TLSH
T1D945B02DF2B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 e98e366efe4eb9cb994eb5003fb730178d211b706e82acb464e3fd37f38f2930
MD5 2f119b80a60d3bfe2ca6e81ad1285e3f
SHA1 1027da4ca6234245e4e1d9f6f358740570bc23c5
SHA512 911d3a066ed0e9ca915994c4fa8fb0004dd3463ff294625cea978514a3db15fa636eca38d259dc9b71348f26aaff4def52ed6cf87da2c4c2263e86dfc58b554e
SSDEEP 12288:IELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:IbNyBo4kx929bL3Hnx
TLSH
T152452312560C627AFA7D3FB0644A8458CC34BC4A0F6597DBEE67987B59BCEE35A30103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 0788a8218d8a3ef5cd35ebb0a3749acafd39cc2fce605ebee2bdc47daf7d89dc
MD5 568f1fe35fffbd5d68df089c38645509
SHA1 b897cbfd726ad164f4eb904d50d166e95f052735
SHA512 75d2b174c9acf86b3656ddaa1b84b4b046d4c33261c881e6a34821a6ffdb26f608ed4b6a6a06c485730906883bcc33da625b5bdef43399a785da5b5a88041ca6
SSDEEP 12288:UObFA4LWOsvAYFTlLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:5xL3UT6NyBo4kx929bL3Hnx
TLSH
T13F750115F79800F9E97B923CC8A68516D672B88D0764E7DF03A84E661F637E24E3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 716776bb2f98373a4b571de859af5943b2abb8b47641a230146aebd0d0cc9776
MD5 0a40b2dd5b1f6c6172ed2ec9eef3705a
SHA1 810e5daf80fc65e6149a60b221121a3ef53c9d84
SHA512 4927c978579327bbb806f7a135996d731cc5ecde65d0e444d5e8820c55b45af5107762ad9705fcbd29e82564ed748fd33b4734403c30f9f89caaa3abf6fcf8a8
SSDEEP 12288:3pFtuORLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0OuNyBo4kx929bL3Hnx
TLSH
T1D155021A369C20F9E579767C9986820DC731BC560B2257EF46A080BE4FB7FF85C35A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5700680e49716e24bb2edb53211735850fce5a8ab1ac3d8ecd288f25267dee77
MD5 21524847568ed539861b1f79ebd814e0
SHA1 af6c5a2d32d0678716d84f3affd74619cf1e3b7a
SHA512 96f8ace79a4f97eeddeabeda51b2c81aa54efdd7b34257b9c0f5d893f0b05f663bfa7265587f90a65afb4adf3f50b262ace94438bf193063eb53a4a5640599d0
SSDEEP 24576:L7NM9YmZqmWMUkPjZM48Mv6bEhsHNyBo4kx929bL3Hnx:L7cBWMpPjN8DbEhLB+kn3Hnx
TLSH
T1B965AE2E6BAC81E5D477D13DC9A28205F6B2B4611B318ACF5162833E6F37AF44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 4e09d30975eef7318e1da0d3e6f95b5a9ad7bf3b7ec861a5cbc0003151d63e51
MD5 122a4be5aa205ae85d8214676a308957
SHA1 b13cfd100f6370f20917888b48e9dc5e1c09cf61
SHA512 85aa8d86fcaa431988b7554c4bd3f1762db858eae96a8339aa997d78af149a1b629c8c8a47f5b96c34606c7cc38cf9b108117e68156ae397c206dc6d6038266b
SSDEEP 24576:TW6BApg2YuyuNDYTabvcRvNYf8km1NNyBo4kx929bL3Hnx:TF2YuHNETovcvNYf8kmIB+kn3Hnx
TLSH
T1CF858E2A27ED80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e7ae8602a479838d9cc1dd814b9876ef72c22b81c00c8956b2122d1d7ea3456d
MD5 60e82bb5b34e33c9a11ef5a6282ffa8b
SHA1 e9da30ec5773735aa5747bdca728738337586562
SHA512 f0e963fcae1cd7540825cbec295661885f24a0e3fac7389620a9b7ce77bb351f7ae0ec3545978062434c019a0a49113a3f3d689de1e858613209b46bf33b9fe7
SSDEEP 24576:bAFs06+OmlfkNXEbToiNyBo4kx929bL3Hnx:UFs060lwXuWB+kn3Hnx
TLSH
T14465BF2F62AC00D5E07ED17D8997C91AF6B1746707255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 dd74069c29bb429bdcfb521169d85834b504e08d29c21ee2d066a874ee8dd16d
MD5 d740533e0be57e1f898cda88830ebeed
SHA1 7ff8f40a9dd2bc91d4d1107a0eb7b6980f57cb32
SHA512 0c36c2bab67f776c93362b671cc792d98fdfa2c747669bdbfa15307799d2146c9c0842863607f8bc17c64e86a5d682a459bc60d9593a27fae4cdc7237e309454
SSDEEP 12288:lCJnJ5D3VkrDzx4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:cJnJ5D3WXBNyBo4kx929bL3Hnx
TLSH
T1B375D02DD2A810F8E4B7D2B4815A1755FE72386D2F226AC768B4D4353F12FE09A79F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 9d55e510b7b50e9fa3301e43ed1c50a10164e883874e6688e43000cddb5f8149
MD5 bad9819084fb2a7b38d989e800a61d65
SHA1 37c910089640049d9aac64811cb39ce479f7d76f
SHA512 83a683049522d15ad74b485b895c64d298d96deada6debe8692d4de40e0b9a9bb19adca2dc673935762349fee9ec74f00862dc63bc68af64b23e28b01b45b563
SSDEEP 24576:mEPohm6/7IIXdwcXrif7qQncjlP65i3VuANyBo4kx929bL3Hnx:ho06DIKdwc+eQnSt65aVsB+kn3Hnx
TLSH
T180955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 93deaa1d7907bd7c3a41f6d9c57eef2716d76ea298948c2b15fd5f3abc1ff410
MD5 2bb12ad95ea3487698bae4326105cf5d
SHA1 4da90beab876be8887b7b67800343f94df031e84
SHA512 c1ab2650c30bd593e97467bff8094f8c283737b9713a25b8d8d76b260da30b794d53b1653477017ee5f234ff45c55cad2503bb3a8ceda3841b2c3f989de40d81
SSDEEP 12288:4EP3RlMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:TlTNyBo4kx929bL3Hnx
TLSH
T13B55122E279C70F9E13A717C94918104C732F4651B5267EF9AA2C17E4E7BEE61E38B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 eb1310e76d91d4d8fccf38fe1e4fdf7313de7d722a0c6e33a394288d3b87cbe3
MD5 878c14a4c67c16728b583c46c53e6155
SHA1 31432f306e9b7e3dece00ec068596088ac0ff367
SHA512 c94d466822204123fd091ed02be0120a4775e3b00f2141a0f79bf0ecf42c5e1ed8e6070ceb8e1bae357cc3a2461763f5e9f470ce1d3efb0512748402583a6d94
SSDEEP 12288:hjky7LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:hIyYNyBo4kx929bL3Hnx
TLSH
T1C1551205538C61A9FAB92A3899678194CD34BC101F2193DF9591E93F5F7AFE1AD30B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 43f5b83f61de9c9a65c5b7a2b0389108aa8df3ac25f3ea504393bab7e083471d
MD5 349adb0b113cec2d3e64ce81c7010daf
SHA1 88fdba316eb20736c092cedbc197f9bbc698962b
SHA512 9ab6fdb5e48855a7f111bfe4f264fc58a289bcee326fec09cede70f9c2d1cf83c489d0839c5b1df55fd27e7f23901efc75ec9810413328da839a8ec007c79d88
SSDEEP 12288:XaBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:q+NyBo4kx929bL3Hnx
TLSH
T196452306161C327AFA3D3BB0645A8554C830BC4E1F51A6FFEDA2D8778ABDED25A31503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 19c0a56b75a5e9f046dc3f48b5721d79d7615a829b147a1e885bb9a6f29defc8
MD5 d588a0e6bc04ed741e8abd0f6c2b78bc
SHA1 cf5fe401dd8a9fb811ab42c050f018aa7fe86d51
SHA512 896f4a49af4fc66a1394d7152d3d76936675845aae39046b74b8f3f9114990f7293feeb438325ab6789bf77ef8b0c0685a4d11e03a8cce3a9e59f4057e16191a
SSDEEP 12288:KLQZb3C97GYnZMv5zBcKY97MD3QLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxfJ:8Q9MxZKdcz97w3vNyBo4kx929bL3Hnx
TLSH
T18C558C2DABE9059AE177D27595A240C3A633B4311B31D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 3691b177ab3c1282f61299521ad95588b7b3d86bb354729dec6861b149b0962c
MD5 eee4a57b6a16bda504174b3750bb29b0
SHA1 dcf5daeb830f76fa3da17d76dd1b867eb7fe64aa
SHA512 76c74cf8324c28009bc2788b2681af728cd8d06ddb00ae06abc83eb5a7c0cb94cf48f4dccdc48dbf5ce260dd3d7a31c0669dba5910ffa785d53f7688707fba47
SSDEEP 12288:XyoKo29Rple9p3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:XyocfApMNyBo4kx929bL3Hnx
TLSH
T1A665E01FBB6D40A2E176923C88858245E773B4341B6253CB6691C73E4F77AE9BD34B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 dba54457abcafd2616e58f55b807e00e244d1703a03f921d09bd1ba852306fd9
MD5 6cf9264f722cce61bdc8a80b89ac6e65
SHA1 bf01d8d3cf8251627b59d823d63e92ab93702491
SHA512 3a61d3a26087b875e4c8a0b5ceb050248364f81f421dfc256c19870832d059eb41bf1a426db6a238e711e331be5879b54a4b81820621cacda7a7a9f51cec0884
SSDEEP 49152:BWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKXB+kn3Hnx:50zuNIF+k
TLSH
T119A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2468485c5aa0654e9d3f309f332233bcf98dd99d2de0e99fff0d083e800bde21
MD5 ffc4da21098ea45dfa44e9e737664808
SHA1 5f54d1e9146e04ef7b468365c89226c676e88e90
SHA512 63299c314fbfce4b80a3d164f17dd043578985a7193580430f42d9ab22f3790a848296a297e7ad00ab88ff97d5629c50c4448d37172031586c11caa3c3ff33bb
SSDEEP 24576:O1QT7EcpfxR+N5AWAz3ooiYujMqb1NyBo4kx929bL3Hnx:DTDxR+N5YzT4jMlB+kn3Hnx
TLSH
T1A955B02EA7FC15E9D1BE85789A23C512FA727811033193CB42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 8198f92146632a7ac2e0f4759bcdec94dd2b572228c732fba5c984157c9f3ab4
MD5 e03ca0ec7a4f7d537515f4e51005f10f
SHA1 5b6387131384ddde32d8743fa996d9a0849b9dfe
SHA512 61b8589ca95280e3e9ff5fd773a146b39474df00a8a58c92cb289ae3fbf9bab609d78b8f5bcdf9245b74c6e30c4b52bad6ea0f77fdefcffafc69a66e5753c516
SSDEEP 24576:ITMdOz0FFS+tmSLpNyBo4kx929bL3Hnx:A0K+tmSLOB+kn3Hnx
TLSH
T10B65E13E636D14F5E57FD27CD6438906E97278660321A6DB0690C07A2F6BFE43A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 2b0507c13fe2939b8cb766cbbbe4f76ae323c858cfdfe96978fb5ce7a2fd8913
MD5 ae4c0c885f56255c46dfad013af58f2c
SHA1 dda3182c9a3863fa53f5a7addf5f37e8c71e7dbd
SHA512 3f6c9aaea6946ccf28a76c42ca54f2866f254bab948eefcebabbadf264b71bbf55a412a49ea8eed44b7953ff6d15a7e2fbdb2fa7f99779eb17202f6a4439f77d
SSDEEP 12288:b49lLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:o6NyBo4kx929bL3Hnx
TLSH
T19D55120913DC30A9F57A76749A2A4154C930BC6A1B2167FF79E1C87F4F7AAD18A34B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/360-160-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/360-369-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/360-154-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/380-228-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/380-391-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/380-234-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/408-124-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/408-365-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/408-118-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/564-364-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/564-107-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/564-113-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1604-15-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1604-9-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1604-19-0x0000000140000000-0x000000014069F000-memory.dmp

Download

memory/1604-485-0x0000000140000000-0x000000014069F000-memory.dmp

Download

memory/1964-488-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1964-279-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/1964-249-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1964-398-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1964-263-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/1964-297-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/1964-467-0x000000000D0A0000-0x000000000D0A8000-memory.dmp

Download

memory/1964-255-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2316-244-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2316-487-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/2316-238-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2316-394-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/2340-181-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2340-175-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2340-373-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2396-381-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2396-224-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2396-218-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2492-366-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/2572-474-0x0000026606190000-0x00000266061A0000-memory.dmp

Download

memory/2572-473-0x0000026606190000-0x00000266061A0000-memory.dmp

Download

memory/2572-477-0x0000026606190000-0x00000266061A0000-memory.dmp

Download

memory/2572-476-0x0000026606190000-0x00000266061A0000-memory.dmp

Download

memory/2572-475-0x0000026606190000-0x00000266061A0000-memory.dmp

Download

memory/2572-471-0x0000026606190000-0x00000266061A0000-memory.dmp

Download

memory/2572-470-0x0000026606190000-0x00000266061A0000-memory.dmp

Download

memory/2572-469-0x0000026606190000-0x00000266061A0000-memory.dmp

Download

memory/2572-472-0x0000026606190000-0x00000266061A0000-memory.dmp

Download

memory/2640-204-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2640-206-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2640-201-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2640-195-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2680-362-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/2680-34-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2680-486-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/2680-27-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2772-463-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2772-461-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2772-149-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2772-143-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2772-368-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2828-214-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2828-208-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2828-380-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3024-44-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3024-38-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3024-405-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3392-81-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3392-87-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3392-91-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3392-93-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/3520-379-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3520-185-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3520-191-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3832-70-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3832-363-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3832-76-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3884-370-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3884-170-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3884-164-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4224-104-0x0000000140000000-0x000000014069F000-memory.dmp

Download

memory/4224-0-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4224-22-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4224-17-0x0000000140000000-0x000000014069F000-memory.dmp

Download

memory/4224-6-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4604-67-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4604-79-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4604-54-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4604-48-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4736-95-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4736-101-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4736-399-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/4752-400-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4752-64-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4752-58-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5040-133-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5040-139-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5040-367-0x0000000140000000-0x0000000140133000-memory.dmp

Download